CVE-2026-98432: Critical Linux Kernel TCP Flaw Enables Unauthenticated Root RCE

In October 2026, a critical vulnerability in the Linux kernel's TCP connection handling was disclosed as CVE-2026-98432. It allows a remote, unauthenticated attacker to execute code with the highest privileges (root) on the target server. This article explains how the flaw works, which systems are affected, and what your business should do today.

At a glance

1. How does the vulnerability work?

The bug lives in the code that handles IP options when the Linux kernel receives TCP handshake packets over IPv4. When several CPU cores process TCP-ACK packets at the same time, one core can free the memory holding the IP options while another core is still reading it. This is a Use-After-Free bug that can be abused to read and overwrite kernel memory.

• Vulnerable code: present in Linux Kernel 4.4 and later.

• Remote exploitation condition: the attacker needs the server to have a listening MPTCP socket to reliably win the race between CPU cores. MPTCP has been in the mainline kernel since 5.6 and is backported to older kernels by some distributions.

• IPv6 is not affected because it copies and manages IP options differently.

2. Why is it especially dangerous?

• No crash: unlike most kernel memory bugs, a failed attempt only breaks the current TCP connection and does not cause a kernel panic. Attackers can quietly retry thousands of times without administrators noticing.

• Two-stage exploit chain:

1. Stage 1 (about 48 minutes): repeatedly send TCP handshake packets carrying IP options to trigger the UAF, causing the kernel to return bytes from freed memory. The attacker uses this leaked data to bypass KASLR.

2. Stage 2 (about 5 minutes): control the contents of the freed memory to hijack execution flow and gain root.

Indicator of compromise (IoC): an unusually large number of TCP-ACK packets carrying IPv4 Options, repeated from the same source IP over 30–60 minutes.

3. Patch status by distribution

Kernel update commands

Debian / Ubuntu (once the patch is available):

sudo apt update && sudo apt upgrade linux-image-generic -y
sudo reboot

RHEL / Rocky Linux / AlmaLinux / Oracle Linux:

sudo dnf update kernel -y
sudo reboot

Amazon Linux 2023:

sudo dnf upgrade kernel -y
sudo reboot

4. Temporary mitigations

Apply these right away if your systems are not yet patched or cannot be rebooted.

Option 1: Disable Multipath TCP (MPTCP)

If you do not need MPTCP, disable it to remove the remote exploitation condition. Check the current status (1 means enabled):

sysctl net.mptcp.enabled

Disable immediately, no reboot required:

sudo sysctl -w net.mptcp.enabled=0

Disable permanently, persisting across reboots:

echo "net.mptcp.enabled = 0" | sudo tee /etc/sysctl.d/90-disable-mptcp.conf
sudo sysctl --system

Option 2: Drop TCP packets with IP options at the firewall

Legitimate IPv4 traffic today almost never uses IP options. A standard IPv4 header is 20 bytes, i.e. IHL = 5, so you can drop TCP packets with IHL > 5.

With nftables (ip hdrlength is counted in 4-byte words, so the standard value is 5; the command assumes an existing inet filter table with an input chain):

sudo nft add rule inet filter input ip protocol tcp ip hdrlength gt 5 counter drop

With iptables (using the u32 module to check the IHL field in the first header byte):

sudo iptables -I INPUT -p tcp -m u32 --u32 "0>>24&0x0f=6:15" -j DROP

5. Administrator checklist

• ☐ Run uname -r to check your kernel version and compare it with the patch table in section 3.

• ☐ Run sysctl net.mptcp.enabled to see whether MPTCP is enabled.

• ☐ List processes listening on MPTCP with ss -M -tlnp.

• ☐ For servers that cannot be updated yet: disable MPTCP or drop packets with IP options at the firewall.

• ☐ Watch for anomalous traffic: large volumes of TCP-ACK packets with IPv4 Options from one source over 30–60 minutes.

• ☐ Schedule the kernel update and reboot as soon as your distribution releases a patch.

6. How ShieldNet Defense helps

• Asset inventory: the Devices view on the Portal shows the operating system and system details of Linux servers running the Agent, so you can quickly scope which servers to check and patch first.

• Monitoring and alerting: the Agent continuously collects and analyzes server activity to detect signs of attack. Post-exploitation behavior is consolidated into incidents on the Portal, with response actions such as Isolate Host or Kill Process.

• SecOps support: if you need help assessing impact or applying mitigations, contact [email protected].

This vulnerability is another reminder that timely patching and reducing attack surface (disabling unused services, filtering anomalous traffic) remain the most effective defenses. Check your systems today.